unbound -- multiple vulnerabilities

2026-07-25 · CVE-2026-14586, CVE-2026-32665, CVE-2026-40691, CVE-2026-41637, CVE-2026-42955, CVE-2026-44621, CVE-2026-44687, CVE-2026-44690, CVE-2026-46582, CVE-2026-50045, CVE-2026-50046, CVE-2026-50243, CVE-2026-50248, CVE-2026-50251, CVE-2026-50252, CVE-2026-52863, CVE-2026-54478, CVE-2026-55708, CVE-2026-55717, CVE-2026-55973, CVE-2026-55990, CVE-2026-55991, CVE-2026-56416, CVE-2026-56444 · VuXML entry

NLnet Labs reports: This release consolidates security fixes for issues reported over a period of time. There are fixes for: CVE-2026-14586: Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments. CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass. CVE-2026-40691: Packet of death for DNSCrypt over TCP. CVE-2026-41637: Degradation of resolution …

Affected versions

• unbound < 1.25.2

By system

1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.